HIPAA Service

HIPAA Incident Response & Breach Notification Planning

The HIPAA Security Rule requires written security incident procedures (45 CFR 164.308(a)(6)) and a contingency plan (45 CFR 164.308(a)(7)), and the Breach Notification Rule (45 CFR 164.400-414) sets out who must be told, and when, after a breach of unsecured patient information. Atascocita IT helps Northeast Houston practices put those plans in writing and practise them with staff before an incident happens.

What incident response planning covers

Three related HIPAA requirements, written down as one plan your practice can actually follow under pressure.

Security incident procedures (45 CFR 164.308(a)(6)): identifying, responding to, mitigating and documenting security incidents
Contingency plan (45 CFR 164.308(a)(7)): data backup, disaster recovery, emergency mode operation, and testing and revision procedures
Breach Notification Rule procedures (45 CFR 164.400-414): deciding whether an incident is a reportable breach and notifying the right people

What you receive

Written documents your practice keeps on file, plus a practice run with your staff.

A written incident response plan with named roles: incident lead, deputy, IT contact, privacy officer, and outside counsel and cyber insurer contacts
Step-by-step playbooks for ransomware, phishing and a lost or stolen device
A breach risk assessment worksheet built on the four factors in 45 CFR 164.402
Notification templates for patients, the media and HHS
A tabletop exercise with your staff and a written after-action summary
A review of your contingency plan and a backup-restore test

Federal breach notification requirements

When a breach of unsecured protected health information is discovered, the Breach Notification Rule sets these notice requirements:

Affected individuals: without unreasonable delay and no later than 60 calendar days after discovery
Breaches affecting 500 or more residents of a state or jurisdiction: prominent media notice in that area and notice to HHS, both within 60 days of discovery
Breaches affecting fewer than 500 individuals: may be logged and reported to HHS within 60 days after the end of the calendar year in which they were discovered

Texas notification requirements

Texas law adds its own deadlines. Texas Business & Commerce Code section 521.053 requires notifying affected individuals within 60 days, and notifying the Texas Attorney General within 30 days when a breach affects 250 or more Texans. Check current requirements with counsel, since state law can change.

How it fits with a risk assessment and the readiness check

A risk assessment shows which threats are most likely to affect your patient data; the incident response plan sets out what your practice does when one of them happens. The free HIPAA readiness self-check at /hipaa-readiness-check is a quick way to see whether your incident and backup controls are a gap today. We coordinate with your existing IT provider and cyber insurer. We do not replace legal counsel, and breach notification decisions should be reviewed with your attorney.

Frequently asked questions

Does a small practice really need a written incident response plan?

Yes. The Security Rule requires every covered entity and business associate, regardless of size, to have security incident procedures and a contingency plan. The plan can be scaled to a small office, but it needs to be written down and kept on file.

How often should we test the plan?

The contingency plan standard includes testing and revision procedures, and HIPAA leaves the frequency to each practice based on its risk analysis. Many practices review the plan at least once a year and after any major change, such as a new EHR, a new location or a real incident.

Is a ransomware attack automatically a HIPAA breach?

According to the HHS ransomware fact sheet, when patient information is encrypted by ransomware, a breach is presumed to have occurred unless the practice can show a low probability that the information was compromised, based on the four-factor risk assessment in 45 CFR 164.402.

Who should we call first during an incident?

Your written plan should name this in advance. Typically the incident lead contacts your IT provider to contain the problem, and your cyber insurer and outside counsel early, because many policies require prompt notice and counsel can guide breach notification decisions.

What is the four-factor breach risk assessment?

Under 45 CFR 164.402, a practice considers the nature and extent of the information involved, who received or used it, whether it was actually acquired or viewed, and how far the risk has been mitigated. The worksheet records that analysis so your decision is documented.

Do you handle the breach notifications for us?

We help you prepare the procedures and templates in advance and support your team during an incident. Notification decisions remain with your practice and its legal counsel. This page is general information, not legal advice.